Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Over the weekend an internet-facing DI-624 router of mine was e-mailing me logs like crazy for some reason. Normally it's a few a day, but it was about one every few minutes instead. Analyzing the messages, I found that only 340 had the same src and dst port number, whereas the majority of "default deny" dropped packets (28,000+) had the two ports different. What does this mean?

share|improve this question
up vote 3 down vote accepted

Source ports and destination ports are normally going to be different. This is normal. When you connect to web site as a client to destination port 80, the OS will likely give the packet a high number source port that is maybe random. Go read about Ephemeral Ports. This aids in the OS keeping track of which session is which.

share|improve this answer
Thanks! So I guess it's only worth looking at the destination ports, then, if anything. – Kev Mar 15 '10 at 17:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.